Network access: Do not allow anonymous enumeration of SAM accounts
A `DWORD` value of `1` represents the enabled state of this Windows security option.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM
A DWORD value of 1 represents the enabled state of this Windows security option. It prevents unauthenticated connections from anonymously enumerating account names managed through the Security Accounts Manager (SAM).
The setting specifically restricts enumeration of SAM accounts. It does not prevent anonymous enumeration of network shares; the separate security option represented by the RestrictAnonymous registry value governs the combined restriction for accounts and shares.
Notes
Additional effects
Microsoft also describes the enabled state as replacing Everyone with Authenticated Users in the relevant security permissions. Permissions available only through Everyone therefore do not apply to an anonymous connection. Access granted through other explicit permissions remains a separate consideration.
Security
The restriction reduces the account information available to an unauthenticated attacker. Without a list of valid account names, the attacker has less information for password-guessing and social-engineering attacks.
The setting does not disable accounts, block authenticated sign-ins, or automatically deny every form of anonymous resource access. Actual access continues to depend on the applicable permissions and other security settings.
Possible side effects
Applications or administrative processes that depend on unauthenticated account discovery can no longer retrieve the affected account lists. This may disrupt account-selection or lookup workflows across a one-way trust when they rely on enumerating accounts in the other domain.
Notes
This is a computer-scoped security option. According to Microsoft, it has no effect on domain controllers.
Microsoft documentation
Microsoft Learn: Network access—Do not allow anonymous enumeration of SAM accounts
Microsoft Learn: Policy CSP—LocalPoliciesSecurityOptions